Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2020-8625High 8.1BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features.isc · bindEPSS64%·Published Mar 11, 2022
- CVE-2022-23940High 8.8SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.salesagility · suitecrmEPSS53%1 exploitPublished Mar 10, 2022
- CVE-2021-4045Critical 9.8TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root.tp-link · tapo c200 firmwareEPSS72%2 exploitsPublished Mar 10, 2022
- CVE-2022-24734High 7.2In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages.mybb · mybbEPSS78%4 exploitsPublished Mar 9, 2022
- CVE-2022-23253Medium 6.5Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerabilitymicrosoft · windows 10EPSS56%·Published Mar 9, 2022
- CVE-2022-23277High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS41%1 exploitPublished Mar 9, 2022
- CVE-2022-24716High 7.5Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials.icinga · icinga web 2EPSS89%1 exploitPublished Mar 8, 2022
- CVE-2022-0441Critical 9.8The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an adminstylemixthemes · masterstudy lmsEPSS85%1 exploitPublished Mar 7, 2022
- CVE-2022-0832Medium 5.4Cross-site Scripting in Pimcorepimcore · pimcoreEPSS67%·Published Mar 7, 2022
- CVE-2021-44827High 8.8There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges.tp-link · archer c20i firmwareEPSS54%·Published Mar 7, 2022
- CVE-2021-46381High 7.5Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].dlink · dap-1620 firmwareEPSS59%2 exploitsPublished Mar 4, 2022
- CVE-2022-0824High 8.8Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.webmin · webminEPSS97%4 exploitsPublished Mar 3, 2022
- CVE-2021-4039Critical 9.8A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.zyxel · nwa1100-nh firmwareEPSS71%2 exploitsPublished Mar 2, 2022
- CVE-2021-41282High 8.8diag_routes.php in pfSense 2.5.2 allows sed data injection.pfsense · pfsenseEPSS87%2 exploitsPublished Mar 1, 2022
- CVE-2021-34798High 7.5Malformed requests may cause the server to dereference a NULL pointer.apache · http serverEPSS65%·Published Mar 1, 2022
- CVE-2022-0412Critical 9.8TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injectiontemplateinvaders · ti woocommerce wishlistEPSS74%·Published Mar 1, 2022
- CVE-2022-25061Critical 9.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.tp-link · tl-wr840n firmwareEPSS59%·Published Feb 28, 2022
- CVE-2022-24288High 8.7OS Command injection in Apache Airflowapache · airflowEPSS78%·Published Feb 26, 2022
- CVE-2022-25305Medium 6.1The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that…veronalabs · wp statisticsEPSS79%1 exploitPublished Feb 24, 2022
- CVE-2022-25149High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to…veronalabs · wp statisticsEPSS77%1 exploitPublished Feb 24, 2022
- CVE-2022-25148High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL…veronalabs · wp statisticsEPSS81%3 exploitsPublished Feb 24, 2022
- CVE-2022-25075Critical 9.8TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function.totolink · a3000ru firmwareEPSS56%·Published Feb 24, 2022
- CVE-2022-23642High 8.8Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service.sourcegraph · sourcegraphEPSS74%4 exploitsPublished Feb 18, 2022
- CVE-2021-44521Critical 9.1cassandra: RCE for scripted UDFsapache · cassandraEPSS58%·Published Feb 17, 2022
- CVE-2021-44142High 8.8samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code executionEPSS74%·Published Feb 17, 2022
- CVE-2022-23307High 8.8CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.apache · chainsawEPSS54%·Published Feb 17, 2022
- CVE-2021-3781Critical 9.9A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command.artifex · ghostscriptEPSS84%·Published Feb 16, 2022
- CVE-2022-0513High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary…veronalabs · wp statisticsEPSS53%·Published Feb 16, 2022
- CVE-2021-24931Critical 9.8Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injectionays-pro · secure copy content protection and content lockingEPSS79%2 exploitsPublished Feb 15, 2022
- CVE-2020-13379High 8.2Server Side Request Forgery in Grafanagrafana · grafanaEPSS100%·Published Feb 15, 2022
- CVE-2018-1002105Critical 9.8Privilege Escalation in Kuberneteskubernetes · kubernetesEPSS87%2 exploitsPublished Feb 15, 2022
- CVE-2021-27358High 7.5Denial of service in Grafanagrafana · grafanaEPSS83%·Published Feb 15, 2022
- CVE-2018-15727Critical 9.8Grafana Authentication Bypassgrafana · grafanaEPSS64%·Published Feb 15, 2022
- CVE-2019-11229High 8.8Gitea Remote Code Executiongitea · giteaEPSS55%·Published Feb 15, 2022
- CVE-2022-0557High 7.2OS Command Injection in Microwebermicroweber · microweberEPSS51%2 exploitsPublished Feb 12, 2022
- CVE-2020-27955Critical 9.8Git LFS can execute a Git binary from the current directorygit large file storage project · git large file storageEPSS82%3 exploitsPublished Feb 11, 2022
- CVE-2022-20705Critical 9.8Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…cisco · rv160 firmwareEPSS80%1 exploitPublished Feb 11, 2022
- CVE-2022-20707High 7.3Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…cisco · rv340 firmwareEPSS75%1 exploitPublished Feb 11, 2022
- CVE-2020-13951High 7.5Denial of service in Apache OpenMeetingsapache · openmeetingsEPSS69%1 exploitPublished Feb 10, 2022
- CVE-2020-13937Medium 5.3Authentication bypass in Apache Kylinapache · kylinEPSS78%·Published Feb 10, 2022
- CVE-2020-13957Critical 9.8Incorrect Authorization in Apache Solrapache · solrEPSS79%·Published Feb 10, 2022
- CVE-2020-13942Critical 9.8Injection and Improper Input Validation in Apache Unomiapache · unomiEPSS68%·Published Feb 10, 2022
- CVE-2020-35774Medium 5.4TwitterServer Cross-site Scripting via /histograms endpointtwitter · twitter-serverEPSS86%·Published Feb 9, 2022
- CVE-2022-21907Critical 9.8HTTP Protocol Stack Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS93%1 exploitPublished Feb 9, 2022
- CVE-2020-13935High 7.5Infinite Loop in Apache Tomcatapache · tomcatEPSS87%·Published Feb 8, 2022
- CVE-2020-13934High 7.5Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcatapache · tomcatEPSS64%·Published Feb 8, 2022
- CVE-2021-25114Critical 9.8The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injectionstrangerstudios · paid memberships proEPSS82%·Published Feb 7, 2022
- CVE-2022-0218Medium 6.1The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file,…codemiq · wordpress email template designerEPSS66%·Published Feb 4, 2022
- CVE-2021-1472Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv160 firmwareEPSS72%2 exploitsPublished Feb 3, 2022
- CVE-2021-1473Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv340 firmwareEPSS64%2 exploitsPublished Feb 3, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-8625 | BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. isc · bind | High 8.1 | 64% | · | |
| CVE-2022-23940 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. salesagility · suitecrm | High 8.8 | 53% | 1 exploit | |
| CVE-2021-4045 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. tp-link · tapo c200 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2022-24734 | In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages. mybb · mybb | High 7.2 | 78% | 4 exploits | |
| CVE-2022-23253 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability microsoft · windows 10 | Medium 6.5 | 56% | · | |
| CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 41% | 1 exploit | |
| CVE-2022-24716 | Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. icinga · icinga web 2 | High 7.5 | 89% | 1 exploit | |
| CVE-2022-0441 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin stylemixthemes · masterstudy lms | Critical 9.8 | 85% | 1 exploit | |
| CVE-2022-0832 | Cross-site Scripting in Pimcore pimcore · pimcore | Medium 5.4 | 67% | · | |
| CVE-2021-44827 | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges. tp-link · archer c20i firmware | High 8.8 | 54% | · | |
| CVE-2021-46381 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. dlink · dap-1620 firmware | High 7.5 | 59% | 2 exploits | |
| CVE-2022-0824 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. webmin · webmin | High 8.8 | 97% | 4 exploits | |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. zyxel · nwa1100-nh firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. pfsense · pfsense | High 8.8 | 87% | 2 exploits | |
| CVE-2021-34798 | Malformed requests may cause the server to dereference a NULL pointer. apache · http server | High 7.5 | 65% | · | |
| CVE-2022-0412 | TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injection templateinvaders · ti woocommerce wishlist | Critical 9.8 | 74% | · | |
| CVE-2022-25061 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. tp-link · tl-wr840n firmware | Critical 9.8 | 59% | · | |
| CVE-2022-24288 | OS Command injection in Apache Airflow apache · airflow | High 8.7 | 78% | · | |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that… veronalabs · wp statistics | Medium 6.1 | 79% | 1 exploit | |
| CVE-2022-25149 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to… veronalabs · wp statistics | High 7.5 | 77% | 1 exploit | |
| CVE-2022-25148 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL… veronalabs · wp statistics | High 7.5 | 81% | 3 exploits | |
| CVE-2022-25075 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. totolink · a3000ru firmware | Critical 9.8 | 56% | · | |
| CVE-2022-23642 | Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service. sourcegraph · sourcegraph | High 8.8 | 74% | 4 exploits | |
| CVE-2021-44521 | cassandra: RCE for scripted UDFs apache · cassandra | Critical 9.1 | 58% | · | |
| CVE-2021-44142 | samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution | High 8.8 | 74% | · | |
| CVE-2022-23307 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. apache · chainsaw | High 8.8 | 54% | · | |
| CVE-2021-3781 | A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. artifex · ghostscript | Critical 9.9 | 84% | · | |
| CVE-2022-0513 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary… veronalabs · wp statistics | High 7.5 | 53% | · | |
| CVE-2021-24931 | Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection ays-pro · secure copy content protection and content locking | Critical 9.8 | 79% | 2 exploits | |
| CVE-2020-13379 | Server Side Request Forgery in Grafana grafana · grafana | High 8.2 | 100% | · | |
| CVE-2018-1002105 | Privilege Escalation in Kubernetes kubernetes · kubernetes | Critical 9.8 | 87% | 2 exploits | |
| CVE-2021-27358 | Denial of service in Grafana grafana · grafana | High 7.5 | 83% | · | |
| CVE-2018-15727 | Grafana Authentication Bypass grafana · grafana | Critical 9.8 | 64% | · | |
| CVE-2019-11229 | Gitea Remote Code Execution gitea · gitea | High 8.8 | 55% | · | |
| CVE-2022-0557 | OS Command Injection in Microweber microweber · microweber | High 7.2 | 51% | 2 exploits | |
| CVE-2020-27955 | Git LFS can execute a Git binary from the current directory git large file storage project · git large file storage | Critical 9.8 | 82% | 3 exploits | |
| CVE-2022-20705 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and… cisco · rv160 firmware | Critical 9.8 | 80% | 1 exploit | |
| CVE-2022-20707 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and… cisco · rv340 firmware | High 7.3 | 75% | 1 exploit | |
| CVE-2020-13951 | Denial of service in Apache OpenMeetings apache · openmeetings | High 7.5 | 69% | 1 exploit | |
| CVE-2020-13937 | Authentication bypass in Apache Kylin apache · kylin | Medium 5.3 | 78% | · | |
| CVE-2020-13957 | Incorrect Authorization in Apache Solr apache · solr | Critical 9.8 | 79% | · | |
| CVE-2020-13942 | Injection and Improper Input Validation in Apache Unomi apache · unomi | Critical 9.8 | 68% | · | |
| CVE-2020-35774 | TwitterServer Cross-site Scripting via /histograms endpoint twitter · twitter-server | Medium 5.4 | 86% | · | |
| CVE-2022-21907 | HTTP Protocol Stack Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 93% | 1 exploit | |
| CVE-2020-13935 | Infinite Loop in Apache Tomcat apache · tomcat | High 7.5 | 87% | · | |
| CVE-2020-13934 | Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat apache · tomcat | High 7.5 | 64% | · | |
| CVE-2021-25114 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection strangerstudios · paid memberships pro | Critical 9.8 | 82% | · | |
| CVE-2022-0218 | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file,… codemiq · wordpress email template designer | Medium 6.1 | 66% | · | |
| CVE-2021-1472 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv160 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2021-1473 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv340 firmware | Critical 9.8 | 64% | 2 exploits |
Showing 1,101–1,150 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.